danabot | 697a11fb5efab2c155e459623ea902409395463c379f4549cc471d806e90f783

Analysis

max time kernel
145s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe
Size

4.0MB
MD5

817e14be1b3a0979390a8c3cc7c4f9d1
SHA1

ce294e099cefdcfb41ef8463a52be5f0dcd0e992
SHA256

697a11fb5efab2c155e459623ea902409395463c379f4549cc471d806e90f783
SHA512

1fc1c1917b583d37ce57903c71a8b987bc3333d0cc309e933dde2f7f816ce5b8e42dd7c883eefd2cbd198952979fb38052cdb1e0756ae023263c4b85db898942
SSDEEP

98304:xiFrwPbHPPquDjTdNwoTPI//JSGZoTw899Y72en:x5bnqunT7woqJpyTw899iH

Score

10^/10

danabot 3 banker collection credential_access discovery execution spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1765

Botnet

192.236.192.241:443

134.119.186.198:443

104.168.156.222:443

192.236.192.238:443

Attributes

embedded_hash
82C66843DE542BC5CB88F713DE39B52B
type
main

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

Processes:

RUNDLL32.EXE

flow	pid	Process
4	2120	RUNDLL32.EXE
5	2120	RUNDLL32.EXE
8	2120	RUNDLL32.EXE
9	2120	RUNDLL32.EXE

Deletes itself 1 IoCs

Processes:

rundll32.exe

pid	Process
3028	rundll32.exe

Loads dropped DLL 8 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

pid	Process
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
2120	RUNDLL32.EXE
2120	RUNDLL32.EXE
2120	RUNDLL32.EXE
2120	RUNDLL32.EXE

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RUNDLL32.EXE

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2544	powershell.exe
1028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeschtasks.exe817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exerundll32.exeRUNDLL32.EXEpowershell.exepowershell.exenslookup.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RUNDLL32.EXE
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	RUNDLL32.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeRUNDLL32.EXEpowershell.exe

pid	Process
2544	powershell.exe
2120	RUNDLL32.EXE
2120	RUNDLL32.EXE
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	3028	rundll32.exe
Token: SeDebugPrivilege	2120	RUNDLL32.EXE
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid	Process
2120	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 2376 wrote to memory of 3028	2376	817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 3028 wrote to memory of 2120	3028	rundll32.exe	31
PID 2120 wrote to memory of 2544	2120	RUNDLL32.EXE	32
PID 2120 wrote to memory of 2544	2120	RUNDLL32.EXE	32
PID 2120 wrote to memory of 2544	2120	RUNDLL32.EXE	32
PID 2120 wrote to memory of 2544	2120	RUNDLL32.EXE	32
PID 2120 wrote to memory of 1028	2120	RUNDLL32.EXE	35
PID 2120 wrote to memory of 1028	2120	RUNDLL32.EXE	35
PID 2120 wrote to memory of 1028	2120	RUNDLL32.EXE	35
PID 2120 wrote to memory of 1028	2120	RUNDLL32.EXE	35
PID 1028 wrote to memory of 2784	1028	powershell.exe	37
PID 1028 wrote to memory of 2784	1028	powershell.exe	37
PID 1028 wrote to memory of 2784	1028	powershell.exe	37
PID 1028 wrote to memory of 2784	1028	powershell.exe	37
PID 2120 wrote to memory of 2400	2120	RUNDLL32.EXE	38
PID 2120 wrote to memory of 2400	2120	RUNDLL32.EXE	38
PID 2120 wrote to memory of 2400	2120	RUNDLL32.EXE	38
PID 2120 wrote to memory of 2400	2120	RUNDLL32.EXE	38
PID 2120 wrote to memory of 2320	2120	RUNDLL32.EXE	40
PID 2120 wrote to memory of 2320	2120	RUNDLL32.EXE	40
PID 2120 wrote to memory of 2320	2120	RUNDLL32.EXE	40
PID 2120 wrote to memory of 2320	2120	RUNDLL32.EXE	40

outlook_office_path 1 IoCs

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

outlook_win_path 1 IoCs

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

C:\Users\Admin\AppData\Local\Temp\817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\817e14be1b3a0979390a8c3cc7c4f9d1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\817E14~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\817E14~1.EXE
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\817E14~1.DLL,UUMOjBzzAg==
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp6E8B.tmp.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2544
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp8C4A.tmp.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Windows\SysWOW64\nslookup.exe
        
        "C:\Windows\system32\nslookup.exe" -type=any localhost
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259485245.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\kzhgdlvvsixxd.tmp

Filesize
2KB

MD5
9bf67bad3108c3cc178b27f98a0b577d

SHA1
70fb3db1212ebe1c25dafde9db48c8b7e9f7edea

SHA256
8478ff29d70eafdc171dd6209dfd3bf4ddf3d633016d9acc018c99408ab5f39f

SHA512
58da423b393e8d234bbd7d8ad3e24de659fee0283d82746969453fb03726381433adbea7c5b0ee8665965642f1ca9e943492c81de2dbdfcb6c59e000eaf15025

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6E8B.tmp.ps1

Filesize
261B

MD5
cb11f327c037bdb893d5199f2abfc754

SHA1
1b90c43c89f6c9ea6e5bd89b14610d5ef6c57f54

SHA256
e619276c2e0f856a2081fe55775bb6abd04106593f28d9e45d6373aa6d3bcc6c

SHA512
ccea457ce7f3d804a36a8519cf7a8871aa227ff9259e98c2f90c20f7f41cbddfa67ba67c56b0f157e23f064ffd4a6e978735e6833ea5ce1bcc017b46048ea404

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8C4A.tmp.ps1

Filesize
80B

MD5
9b5d93d5920d453b2e68e3fdf910f135

SHA1
58ea210eea940c5db3b52128499a23e39426ae82

SHA256
4d18ed88a1c373da3d79b75dee308c3e8fa07c92dfd95372926f44c69084621a

SHA512
6f6e39c94d20c95f176b9be0a6d313d3a2ce9d6556085b3ee00b6866067a78d4243ec908d2afb2bbba50107e30d8eb27ca1f760b46188f7495b3dfb37f50cbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8C4B.tmp

Filesize
86B

MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
42c42a3d5b49715bc050a1009d36cd79

SHA1
2dd854fd4d097c9248d536171b18ca60b920de58

SHA256
ab65817b7a07cab315bf9a2fa34aca88faefefa98cae09d8ff9fb434b7107635

SHA512
b5099532ec5c002e73ad0b74acc5f859cc0a9b4c7cc04d219bf4ae94744f6b0e8ec693e832cac64a201338318936bfd35882aab4ad04e529c1da7fb2afd809a8

Download Submit
\Users\Admin\AppData\Local\Temp\817E14~1.DLL

Filesize
3.8MB

MD5
bfd6071199ed716a90c57a78b45274b4

SHA1
c2af91e2fee92907868eff13a39c2b3787fca4f1

SHA256
b64a043a5a33d465e2e8d69a087bc90be11d39b1495ca355c2e3ce4fd1824ee1

SHA512
cab575f60e4156923c8db09de32da40250d01ebdc932bf0333f5075f9fb62123c6d7262af63333dd4901b796a8893f49569f1e5f738cbfff2560c5e39f98d7ce

Download Submit
memory/2120-23-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2120-56-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2120-112-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2120-111-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2120-20-0x0000000001F30000-0x00000000022FE000-memory.dmp

Filesize
3.8MB

Download
memory/2120-57-0x0000000001F30000-0x00000000022FE000-memory.dmp

Filesize
3.8MB

Download
memory/2120-22-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2120-24-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2120-26-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2120-25-0x0000000002710000-0x0000000002D72000-memory.dmp

Filesize
6.4MB

Download
memory/2376-0-0x0000000000E50000-0x000000000121D000-memory.dmp

Filesize
3.8MB

Download
memory/2376-7-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2376-5-0x0000000000400000-0x0000000000C93000-memory.dmp

Filesize
8.6MB

Download
memory/2376-3-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2-0x0000000001220000-0x00000000015FF000-memory.dmp

Filesize
3.9MB

Download
memory/2376-1-0x0000000000E50000-0x000000000121D000-memory.dmp

Filesize
3.8MB

Download
memory/3028-13-0x0000000002610000-0x0000000002C72000-memory.dmp

Filesize
6.4MB

Download
memory/3028-15-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/3028-12-0x0000000001D30000-0x00000000020FE000-memory.dmp

Filesize
3.8MB

Download
memory/3028-21-0x0000000002610000-0x0000000002C72000-memory.dmp

Filesize
6.4MB

Download
memory/3028-14-0x0000000002610000-0x0000000002C72000-memory.dmp

Filesize
6.4MB

Download